-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability involves improper authorization (CWE-285/863) leading to privilege escalation. Magento's admin controllers and API endpoints are common vectors for such issues. The listed functions are inferred based on patterns in historical Magento vulnerabilities (e.g., missing _isAllowed() checks in controllers, weak authentication logic, or API ACL bypasses). Without patch/diff data, confidence remains medium, as these are educated guesses aligned with the described attack vector (session takeover via authorization bypass).
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| magento/community-edition | composer | >= 2.4.8-beta1, < 2.4.8-beta2 | 2.4.8-beta2 |
| magento/community-edition | composer | >= 2.4.7-beta1, < 2.4.7-p4 | 2.4.7-p4 |
| magento/community-edition | composer | >= 2.4.6-p1, < 2.4.6-p9 | 2.4.6-p9 |
| magento/community-edition | composer | >= 2.4.5-p1, < 2.4.5-p11 | 2.4.5-p11 |
| magento/community-edition | composer | < 2.4.4-p12 | 2.4.4-p12 |
| magento/project-community-edition | composer | <= 2.0.2 |